diff --git a/.github/actions/test/action.yaml b/.github/actions/test/action.yaml
index 91b5b8a..3fc8a5b 100644
--- a/.github/actions/test/action.yaml
+++ b/.github/actions/test/action.yaml
@@ -28,5 +28,5 @@ runs:
       shell: bash
 
     - name: Run tests
-      run: go test -v ./...
+      run: go test -v -coverprofile=coverage.txt -covermode=atomic ./...
       shell: bash
diff --git a/.github/codecov.yaml b/.github/codecov.yaml
new file mode 100644
index 0000000..045bde2
--- /dev/null
+++ b/.github/codecov.yaml
@@ -0,0 +1,13 @@
+coverage:
+  status:
+    project:
+      default:
+        target: 80%
+        threshold: 0%
+        if_ci_failed: error
+    patch:
+      default:
+        target: 80%
+        threshold: 0%
+        if_ci_failed: error
+        only_pulls: true
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
new file mode 100644
index 0000000..c4d782c
--- /dev/null
+++ b/.github/workflows/codeql.yaml
@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "27 4 * * 1" # weekly, Monday ~04:27 UTC
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (Go)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26"
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: go
+          build-mode: autobuild
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 18513f4..498e2e9 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -3,6 +3,9 @@ name: Pull Request
 on:
   pull_request:
     branches: [main]
+  
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -18,3 +21,11 @@ jobs:
 
       - name: Test
         uses: ./.github/actions/test
+      
+      - name: Upload coverage to Codecov
+        if: matrix.os == 'ubuntu-latest'
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage.txt
+          fail_ci_if_error: false
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f49aaaf..2429344 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -23,6 +23,14 @@ jobs:
       - name: Test
         uses: ./.github/actions/test
 
+      - name: Upload coverage to Codecov
+        if: matrix.os == 'ubuntu-latest'
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage.txt
+          fail_ci_if_error: false
+
   release:
     name: Release
     runs-on: ubuntu-latest
diff --git a/README.md b/README.md
index 85f3cc5..e14718f 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,7 @@
 
 [![Release](https://img.shields.io/github/v/release/borisdvlpr/gotail)](https://github.com/borisdvlpr/gotail/releases)
 [![CI](https://github.com/borisdvlpr/gotail/actions/workflows/pull-request.yaml/badge.svg)](https://github.com/borisdvlpr/gotail/actions/workflows/pull-request.yaml)
+[![Codecov](https://codecov.io/github/borisdvlpr/gotail/graph/badge.svg?token=QJTVO5NX58)](https://codecov.io/github/borisdvlpr/gotail)
 [![License](https://img.shields.io/github/license/borisdvlpr/gotail)](LICENSE)
 [![OSS hosting by Cloudsmith](https://img.shields.io/badge/OSS%20hosting%20by-cloudsmith-blue?logo=cloudsmith)](https://cloudsmith.com)