diff --git a/.github/workflows/codecov-checks.yaml b/.github/workflows/codecov-checks.yaml
new file mode 100644
index 00000000..8c9b77bf
--- /dev/null
+++ b/.github/workflows/codecov-checks.yaml
@@ -0,0 +1,65 @@
+name: Codecov Config Checks
+
+on:
+  push:
+    branches:
+      - main
+      - 'release-[0-9]+.[0-9]+'
+    paths:
+      - codecov.yml
+      - .github/workflows/codecov-checks.yaml
+  pull_request:
+    branches:
+      - main
+      - 'release-[0-9]+.[0-9]+'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate Codecov Config
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Get changed files
+        if: github.event_name == 'pull_request'
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            codecov.yml
+            .github/workflows/codecov-checks.yaml
+
+      - name: Validate codecov.yml
+        if: github.event_name != 'pull_request' || steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          response=$(curl -s -w "\n%{http_code}" --retry 3 --retry-delay 5 \
+            -X POST \
+            --data-binary @codecov.yml \
+            https://codecov.io/validate)
+
+          http_code=$(echo "$response" | tail -n1)
+          body=$(echo "$response" | sed '$d')
+
+          echo "HTTP Status: ${http_code}"
+          echo "Response: ${body}"
+
+          if [ "$http_code" -eq 400 ]; then
+            echo "::error::Invalid codecov.yml configuration"
+            exit 1
+          elif [ "$http_code" -ne 200 ]; then
+            echo "::warning::Could not validate codecov.yml (HTTP ${http_code}). Transient issue?"
+            exit 1
+          fi
+
+          echo "codecov.yml is valid"
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index d72382de..2b2a22cd 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -1,4 +1,4 @@
-name: Nightly E2E Tests
+name: Nightly Tests
 
 on:
   schedule:
@@ -9,6 +9,72 @@ permissions:
   contents: read
 
 jobs:
+  lint:
+    name: Lint (${{ matrix.branch }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        branch:
+          - main
+          # release-1.10 is bash-based and has no golangci-lint config
+          - release-2.1
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ matrix.branch }}
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+
+      - name: Run lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
+        with:
+          version: v2.14.0
+
+  unit-tests:
+    name: Unit Tests (${{ matrix.branch }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        branch:
+          - main
+          - release-1.10
+          - release-2.1
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ matrix.branch }}
+          fetch-depth: 0
+
+      - name: Capture commit SHA
+        run: echo "COMMIT_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+
+      - name: Run tests
+        run: make test
+
+      # release-1.10 is bash-based; its Makefile does not produce cover.out
+      - name: Upload coverage to Codecov
+        if: matrix.branch != 'release-1.10'
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
+        with:
+          files: cover.out
+          flags: unittests,nightly
+          fail_ci_if_error: false
+          override_commit: ${{ env.COMMIT_SHA }}
+          override_branch: ${{ matrix.branch }}
+
   e2e-tests:
     name: Nightly E2E Tests (${{ matrix.branch }})
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 9bc758ac..ffd796fa 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -49,6 +49,16 @@ jobs:
         if: steps.changed-files.outputs.any_changed == 'true'
         run: make test
 
+      - name: Upload coverage to Codecov
+        if: steps.changed-files.outputs.any_changed == 'true'
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
+        with:
+          files: cover.out
+          flags: unittests
+          fail_ci_if_error: false
+          override_commit: ${{ github.event.pull_request.head.sha }}
+          override_pr: ${{ github.event.number }}
+
       - name: Run lint
         if: steps.changed-files.outputs.any_changed == 'true'
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
diff --git a/.gitignore b/.gitignore
index 90a08359..20582611 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,5 +44,6 @@ rhdh-must-gather-output.tar.gz
 
 # Go
 *.test
+cover.out
 coverage.out
 
diff --git a/Makefile b/Makefile
index 93013e9a..13c7b5b8 100644
--- a/Makefile
+++ b/Makefile
@@ -75,7 +75,7 @@ endif
 
 .PHONY: test
 test: ## Run unit tests
-	$(GO) test -mod=mod ./... -v -count=1
+	$(GO) test -mod=mod ./... -v -count=1 -coverprofile=cover.out
 
 .PHONY: lint
 lint: ## Run linter (golangci-lint)
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..8798ee3f
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,34 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: auto
+        threshold: 5%
+        informational: true
+
+comment:
+  layout: "reach, diff, flags, files"
+  behavior: default
+
+flags:
+  unittests:
+    paths:
+      - cmd/
+      - internal/
+    carryforward: true
+  nightly:
+    paths:
+      - cmd/
+      - internal/
+    carryforward: true
+
+ignore:
+  - tests/
+  - hack/
+  - scripts/
+  - cmd/gather/main.go