diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e8566a..f4a8dad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,4 +52,10 @@ jobs:
       - name: Test
         # Network I/O is isolated in the *_utils modules and mocked there, so
         # the suite needs neither a live network nor any external binary.
-        run: pytest --tb=short -q
+        #
+        # --cov-fail-under lives here rather than in pyproject addopts: in
+        # addopts it also applies to targeted runs such as
+        # `pytest tests/test_x.py::TestY -v`, which measure the whole package
+        # while executing one class and so fail the gate at ~3% coverage even
+        # when every selected test passes.
+        run: pytest --tb=short -q --cov-fail-under=100
diff --git a/pyproject.toml b/pyproject.toml
index d83b72c..115362d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -75,4 +75,4 @@ select = ["E4", "E7", "E9", "F"]
 [tool.pytest.ini_options]
 pythonpath = ["."]
 testpaths = ["tests"]
-addopts = "--cov=headersvalidator --cov-report=term-missing --cov-fail-under=100"
+addopts = "--cov=headersvalidator --cov-report=term-missing"