diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml
index 5e138fe..4d6c5a4 100644
--- a/.github/workflows/build-wheel.yml
+++ b/.github/workflows/build-wheel.yml
@@ -8,6 +8,11 @@ on:
         required: false
         type: string
         default: ""
+      upload-coverage-artifact:
+        description: Whether to upload the Cobertura coverage.xml as an artifact for a downstream code-coverage upload job
+        required: false
+        type: boolean
+        default: true
 
 jobs:
   build-wheel:
@@ -52,6 +57,19 @@ jobs:
           if-no-files-found: warn
           retention-days: 14
 
+      # Cobertura XML for the actions/upload-code-coverage step in the calling workflow.
+      # Skipped for fork PRs, which can't be granted `code-quality: write` anyway.
+      - name: Upload coverage.xml artifact
+        if: |
+          always() && inputs.upload-coverage-artifact &&
+          (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-coverage-cobertura
+          path: regi-headless/build/reports/coverage/coverage.xml
+          if-no-files-found: warn
+          retention-days: 14
+
       - name: Collect wheel
         run: |
           mkdir -p dist
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c9f1b40..c5f15a0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,6 +18,30 @@ jobs:
     name: Build and test
     uses: ./.github/workflows/build-wheel.yml
 
+  upload-coverage:
+    name: Upload code coverage
+    needs: build-wheel
+    if: ${{ !cancelled() && needs.build-wheel.result == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      code-quality: write
+      pull-requests: read
+
+    steps:
+      - name: Download coverage.xml artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: python-coverage-cobertura
+
+      - name: Upload code coverage
+        uses: actions/upload-code-coverage@v1
+        with:
+          file: coverage.xml
+          language: Python
+          label: code-coverage/pytest-cov
+          fail-on-error: false
+
   dependency-submission:
     name: Submit Gradle dependencies
     needs: build-wheel
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3c0e6d6..470e2f9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,7 @@ jobs:
     uses: ./.github/workflows/build-wheel.yml
     with:
       ref: ${{ github.event.release.tag_name }}
+      upload-coverage-artifact: false
 
   publish-wheel:
     name: Publish Python wheel to GitHub Release