diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml
index 693d0baa3..c738cec1c 100644
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -215,6 +215,10 @@ jobs:
           make ARCH=${{ matrix.makearch }} PREFIX=/usr DESTDIR=/destdir EFIDIR=test ENABLE_SHIM_HASH=true install
           echo 'results:'
           find /destdir -type f
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   build-pull-request-intel-compile-commands-json:
     runs-on: ubuntu-24.04
diff --git a/Makefile b/Makefile
index d7fa2a250..391ca1986 100644
--- a/Makefile
+++ b/Makefile
@@ -478,6 +478,7 @@ fuzz fuzz-clean fuzz-coverage fuzz-lto :
 		EFI_INCLUDES="$(EFI_INCLUDES)" \
 		fuzz-clean $@
 
+test test-clean test-coverage test-lto : | clean-test-results
 test test-clean test-coverage test-lto : generated_sbat_var_defs.h
 	@make -f $(TOPDIR)/include/test.mk \
 		COMPILER="$(COMPILER)" \
@@ -491,6 +492,7 @@ $(patsubst %.c,%,$(wildcard fuzz-*.c)) :
 	@make -f $(TOPDIR)/include/fuzz.mk EFI_INCLUDES="$(EFI_INCLUDES)" ARCH_DEFINES="$(ARCH_DEFINES)" $@
 
 $(patsubst %.c,%,$(wildcard test-*.c)) :
+	@make clean-test-results
 	@make -f $(TOPDIR)/include/test.mk EFI_INCLUDES="$(EFI_INCLUDES)" ARCH_DEFINES="$(ARCH_DEFINES)" $@
 
 clean-fuzz-objs:
@@ -540,6 +542,9 @@ clean-cryptlib-objs:
 
 clean: clean-shim-objs clean-fuzz-objs clean-test-objs clean-gnu-efi clean-openssl-objs clean-cryptlib-objs clean-lib-objs
 
+clean-test-results:
+	@rm -vf *.gcda *.gcno *.gcov
+
 GITTAG = $(shell echo $(VERSION) | sed 's/~/-/g')
 
 test-archive:
diff --git a/include/test.mk b/include/test.mk
index 7b2338cce..4e706c049 100644
--- a/include/test.mk
+++ b/include/test.mk
@@ -26,6 +26,8 @@ CFLAGS = $(OPTIMIZATIONS) -std=gnu11 \
 	 -fno-builtin \
 	 -rdynamic \
 	 -fno-inline \
+	 $(if $(findstring gcc,$(CC)),-fprofile-arcs) \
+	 $(if $(findstring gcc,$(CC)),-ftest-coverage) \
 	 $(if $(findstring gcc,$(CC)),-fno-eliminate-unused-debug-types) \
 	 $(if $(findstring gcc,$(CC)),-fno-eliminate-unused-debug-symbols) \
 	 -gpubnames \
@@ -130,7 +132,7 @@ test-coverage : $(tests)
 
 test-clean :
 	@rm -vf test-random.h libefi-test.a
-	@rm -vf *.gcda *.gcno *.gcov vgcore.*
+	@rm -vf vgcore.*
 
 clean : test-clean