diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index e2e5314f..315fcecd 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -10,6 +10,7 @@ Il workflow `ci.yml` esegue i seguenti check automatici:
 
 ### 2. Test Coverage
 - Frontend: vitest con coverage reporting
+- Upload automatico su Codecov dai report LCOV frontend + Rust
 - Threshold configurabile in `vitest.config.ts`
 
 ### 3. Code Health (CodeScene)
@@ -40,6 +41,11 @@ CODESCENE_PROJECT_ID=<your-project-id>
 Il PAT di CodeScene è lo stesso che usi localmente (~/.codescene/token).
 Il project ID lo trovi nella dashboard CodeScene.
 
+### Codecov Setup
+- Installa/attiva il repo in Codecov una volta sola tramite GitHub App / import del repository.
+- Nessun `CODECOV_TOKEN` richiesto in GitHub Actions: `ci.yml` usa OIDC (`id-token: write` + `use_oidc: true`).
+- Il workflow carica `coverage/lcov.info` (Vitest) e `coverage/rust.lcov` (cargo-llvm-cov).
+
 ### Telemetry Secrets For Release Builds
 Aggiungi anche questi secrets per i workflow `release.yml` e `release-stable.yml`:
 
@@ -97,8 +103,11 @@ codescene delta-analysis --base-revision origin/main
 
 ## Workflow Triggers
 
-- **Push**: su `main` e branch `experiment/*`
+- **Push**: su `main`
 - **Pull Request**: verso `main`
+- **Manuale**: `workflow_dispatch`
+
+Nota: l'upload a Codecov gira su push a `main` e sulle PR dello stesso repository. Le PR da fork saltano l'upload per evitare problemi di permessi OIDC.
 
 ## Status Checks
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 497b8bbf..a926c6fa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,13 @@ name: CI
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
 
 env:
   # Bump this when Tauri/Rust target artifacts capture stale absolute paths.
@@ -78,10 +85,23 @@ jobs:
           cargo llvm-cov \
             --manifest-path src-tauri/Cargo.toml \
             --ignore-filename-regex 'lib\.rs|main\.rs|menu\.rs' \
+            --lcov \
+            --output-path coverage/rust.lcov \
             --fail-under-lines 85
         # cargo-llvm-cov exits non-zero if line coverage drops below 85%
         # lib.rs/main.rs/menu.rs are Tauri boilerplate -- not meaningfully unit-testable.
 
+      - name: Upload coverage to Codecov
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: codecov/codecov-action@v5
+        with:
+          use_oidc: true
+          fail_ci_if_error: true
+          disable_search: true
+          files: ./coverage/lcov.info,./coverage/rust.lcov
+          verbose: true
+        # OIDC avoids long-lived CODECOV_TOKEN secrets.
+
       # ── 3. Code Health (CodeScene — Hotspot + Average Code Health gates) ──
       # Enforces minimum floors on BOTH hotspot and average code health.
       # Thresholds come from .codescene-thresholds so CI and local hooks match.
diff --git a/README.md b/README.md
index 5532fac6..d72e6c20 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-![Latest stable](https://img.shields.io/github/v/release/refactoringhq/tolaria?display_name=tag) ![CodeScene Hotspot Code Health](https://codescene.io/projects/76865/status-badges/hotspot-code-health)
+![Latest stable](https://img.shields.io/github/v/release/refactoringhq/tolaria?display_name=tag) [![CI](https://github.com/refactoringhq/tolaria/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/refactoringhq/tolaria/actions/workflows/ci.yml) [![Build](https://github.com/refactoringhq/tolaria/actions/workflows/release.yml/badge.svg?branch=main)](https://github.com/refactoringhq/tolaria/actions/workflows/release.yml) [![CodeScene Hotspot Code Health](https://codescene.io/projects/76865/status-badges/hotspot-code-health)](https://codescene.io/projects/76865) [![CodeScene Average Code Health](https://codescene.io/projects/76865/status-badges/average-code-health)](https://codescene.io/projects/76865) [![Codecov](https://codecov.io/gh/refactoringhq/tolaria/graph/badge.svg?branch=main)](https://codecov.io/gh/refactoringhq/tolaria)
 
 # 💧 Tolaria
 
diff --git a/vite.config.ts b/vite.config.ts
index bc7a9bf2..fe6a7b08 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -526,7 +526,7 @@ export default defineConfig({
     include: ['src/**/*.{test,spec}.{ts,tsx}'],
     coverage: {
       provider: 'v8',
-      reporter: ['text', 'json', 'html'],
+      reporter: ['text', 'json', 'html', 'lcov'],
       // Keep coverage temp files off the mounted workspace to avoid flaky
       // read-after-write races when Vitest re-reads its own coverage shards.
       reportsDirectory: vitestCoverageDirectory,