diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6c8efb7..c2af1c7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -110,3 +110,22 @@ jobs:
         with:
           flags: integration
           token: ${{ secrets.CODECOV_TOKEN }}
+
+  coverage-notify:
+    needs: test
+    permissions:
+      contents: read
+    # A failed matrix job still gets a report from what did upload.
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Codecov
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          run_command: send-notifications
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..761a815
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,20 @@
+codecov:
+  branch: main
+  notify:
+    # Statuses and the comment wait for `coverage-notify` in test.yml, which
+    # runs once every matrix job has uploaded, not after the first few.
+    manual_trigger: true
+coverage:
+  precision: 2
+  round: down
+  range: "70...100"
+  status:
+    project:
+      default:
+        target: auto
+        # Which branch of a race a watcher test takes depends on the runner's
+        # timing, so the same code covers a few lines more or less run to run.
+        threshold: 0.5%
+    patch:
+      default:
+        target: auto