diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 82f4163a..1521850f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,6 +67,43 @@ jobs:
       - name: run e2e tests
         run: make e2e-tests
 
+  coverage:
+    name: coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
+        with:
+          profile: minimal
+          toolchain: stable
+          override: true
+      - uses: taiki-e/install-action@5794068c211bc8f5f4514b7c3f03d6adbe66f1b7 # v2.26.18
+        with:
+          tool: cargo-tarpaulin
+      - name: Generate unit-tests coverage
+        run: make coverage-unit-tests
+      - name: Upload unit-tests coverage to Codecov
+        uses: codecov/codecov-action@e0b68c6749509c5f83f984dd99a76a1c1a231044 # v4.0.1
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_ORG_TOKEN }}
+        with:
+          name: unit-tests
+          directory: coverage/unit-tests
+          flags: unit-tests
+          verbose: true
+      - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
+      - name: Generate e2e-tests coverage
+        run: make coverage-e2e-tests
+      - name: Upload e2e-tests coverage to Codecov
+        uses: codecov/codecov-action@e0b68c6749509c5f83f984dd99a76a1c1a231044 # v4.0.1
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_ORG_TOKEN }}
+        with:
+          name: e2e-tests
+          directory: coverage/e2e-tests
+          flags: e2e-tests
+          verbose: true
+
   fmt:
     name: Rustfmt
     runs-on: ubuntu-latest
diff --git a/.gitignore b/.gitignore
index 1ccfac87..78dd5b23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,6 @@
 /target
 /bin
 bom-cargo.json
+
+# coverage instrumentation:
+*.profraw
diff --git a/Makefile b/Makefile
index b3f2c650..90f6a188 100644
--- a/Makefile
+++ b/Makefile
@@ -17,6 +17,21 @@ test: fmt lint
 .PHONY: e2e-tests
 e2e-tests:
 	cargo test --test '*'
+	
+.PHONY: coverage
+coverage: coverage-unit-tests coverage-e2e-tests
+	
+.PHONY: coverage-unit-tests
+coverage-unit-tests:
+	cargo tarpaulin --verbose --skip-clean --engine=llvm \
+		--all-features --workspace --follow-exec \
+		--out xml --out html --output-dir coverage/unit-tests
+	
+.PHONY: coverage-e2e-tests
+coverage-e2e-tests:
+	cargo tarpaulin --verbose --skip-clean --engine=llvm \
+		--all-features --test '*' --follow-exec \
+		--out xml --out html --output-dir coverage/e2e-tests
 
 .PHONY: clean
 clean:
diff --git a/coverage/integration-tests/.gitignore b/coverage/integration-tests/.gitignore
new file mode 100644
index 00000000..5e7d2734
--- /dev/null
+++ b/coverage/integration-tests/.gitignore
@@ -0,0 +1,4 @@
+# Ignore everything in this directory
+*
+# Except this file
+!.gitignore
diff --git a/coverage/unit-tests/.gitignore b/coverage/unit-tests/.gitignore
new file mode 100644
index 00000000..5e7d2734
--- /dev/null
+++ b/coverage/unit-tests/.gitignore
@@ -0,0 +1,4 @@
+# Ignore everything in this directory
+*
+# Except this file
+!.gitignore