diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ce8b484..5189e7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,8 +12,9 @@ env:
 
 # Every job sets `timeout-minutes`: the default is 6 hours, and a hung test would otherwise hold a
 # required check until the merge queue gives up at 60 minutes. The limits are several times the
-# slowest run seen over the last 100 runs (113 s, Windows test); the jobs that run tests get 15,
-# the build-only ones 10.
+# slowest run seen over the last 100 runs (113 s, Windows test); the jobs that run tests get 15
+# (so does Coverage, which can build twice when it has to recompute a baseline), the build-only
+# ones 10.
 jobs:
   test:
     name: Test (${{ matrix.os }})
@@ -66,3 +67,31 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo doc --locked --no-deps --document-private-items
+
+  # patchcov measures its own pull requests with the action it ships. It is advisory: not in
+  # the ruleset, so a red run never blocks a merge. The action installs the Rust toolchain,
+  # the cache and cargo-llvm-cov itself. It publishes the baseline on a push to main, from
+  # this workflow (the action looks for `ci.yml`), and comments and gates on pull requests.
+  # On a merge_group run it would only repeat the instrumented tests, so the job is skipped
+  # there; a skipped job counts as passing if it is ever made required. Only `@v1` is
+  # tagged; `v1` defaults to an old patchcov, so `version` asks for the current release.
+  coverage:
+    name: Coverage
+    if: github.event_name != 'merge_group'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      actions: read # find and download the baseline artifact of the merge base's run
+      pull-requests: write # post the coverage comment
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0 # full history so the merge base resolves
+      - uses: action-works/patchcov-action@v1
+        with:
+          version: latest
+          fail-under-patch: 90
+          fail-under-lines: 95
+          # A fork's token is read-only, so the comment would fail; the gates still apply.
+          comment: ${{ github.event.pull_request.head.repo.fork != true }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index af5da6f..fed3a75 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -100,6 +100,17 @@ It can go red when a transitive dependency raises its MSRV, so it runs weekly an
 required check: do not add it to the ruleset or the list below. Fix a failure by pinning or
 capping the dependency in `Cargo.toml`, or by raising the MSRV on purpose.
 
+CI's `Coverage` job runs [action-works/patchcov-action](https://github.com/action-works/patchcov-action)
+on pull requests, so patchcov measures itself with the workflow it recommends. It posts a sticky
+comment with the patch coverage and the uncovered new lines, fails below 90% patch coverage or 95%
+overall line coverage, and on a push to `main` publishes the baseline that later pull requests are
+compared with. Like the scheduled workflow above it is advisory: it is not in the ruleset or the
+list below, so a red run does not block a merge. It is skipped on `merge_group`, where the action
+would only repeat the instrumented tests. The job grants `actions: read` as well as
+`pull-requests: write` because the baseline is another run's artifact. Pull requests from forks
+get a read-only token, so the job sets `comment: false` for them: the gates still apply, and the
+numbers are in the run's Summary tab.
+
 `lint-markers` also runs in CI's `Lint` job. This repository's
 [`.patchcov/config.yaml`](.patchcov/config.yaml) limits it to Rust sources, so prose in
 documentation that describes the marker syntax is not flagged.
diff --git a/README.md b/README.md
index 5401f2b..5385440 100644
--- a/README.md
+++ b/README.md
@@ -259,9 +259,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: read               # to download the baseline from the merge base's run
       pull-requests: write        # to post the coverage comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0          # full history so the merge base resolves
       - uses: action-works/patchcov-action@v1
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 463c383..35f0d80 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -124,7 +124,7 @@ also mean the default branch has another name and `origin/HEAD` is not set; run
 - **GitHub Actions:** check out with full history.
 
   ```yaml
-  - uses: actions/checkout@v4
+  - uses: actions/checkout@v7
     with:
       fetch-depth: 0
   ```