diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 8229fbbe..b6a19327 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -33,7 +33,15 @@ jobs:
     steps:
       - uses: "actions/checkout@v5"
       - uses: "authzed/actions/setup-go@main"
-      - uses: "authzed/actions/go-test@main"
+      - name: "Unit tests with coverage"
+        run: "go run mage.go test:runWithCoverage"
+      - name: "Upload coverage to Codecov"
+        uses: "codecov/codecov-action@v5.5.1"
+        with:
+          files: "./coverage.txt"
+          verbose: true
+          token: "${{ secrets.CODECOV_TOKEN }}"
+          fail_ci_if_error: false
 
   development:
     name: "WASM Tests"
diff --git a/.gitignore b/.gitignore
index a7fe944c..2ef25bdf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ docs/merged.md
 # Local-only files
 go.work
 go.work.sum
+coverage.txt
\ No newline at end of file
diff --git a/README.md b/README.md
index 355af5ff..cf731113 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@
 [![Discord Server](https://img.shields.io/discord/844600078504951838?color=7289da&logo=discord "Discord Server")](https://authzed.com/discord)
 [![Twitter](https://img.shields.io/badge/twitter-%40authzed-1D8EEE?logo=twitter "@authzed on Twitter")](https://twitter.com/authzed)
 [![Docker Pulls](https://img.shields.io/docker/pulls/authzed/zed?color=%23448CE6&style=flat-square)](https://hub.docker.com/r/authzed/zed/tags)
+[![Codecov](https://img.shields.io/codecov/c/github/authzed/zed)](https://app.codecov.io/gh/authzed/zed)
 
 A command-line client for managing [SpiceDB].
 
diff --git a/mage.go b/mage.go
new file mode 100644
index 00000000..6a3b958e
--- /dev/null
+++ b/mage.go
@@ -0,0 +1,11 @@
+//go:build ignore
+
+package main
+
+import (
+	"os"
+
+	"github.com/magefile/mage/mage"
+)
+
+func main() { os.Exit(mage.Main()) }
diff --git a/magefiles/build.go b/magefiles/build.go
index 19e1c38c..899638a9 100644
--- a/magefiles/build.go
+++ b/magefiles/build.go
@@ -1,3 +1,6 @@
+//go:build mage
+// +build mage
+
 package main
 
 import (
diff --git a/magefiles/test.go b/magefiles/test.go
new file mode 100644
index 00000000..5e2112a4
--- /dev/null
+++ b/magefiles/test.go
@@ -0,0 +1,21 @@
+//go:build mage
+// +build mage
+
+package main
+
+import (
+	"github.com/magefile/mage/mg"
+	"github.com/magefile/mage/sh"
+)
+
+type Test mg.Namespace
+
+// Run runs unit tests
+func (g Test) Run() error {
+	return sh.RunV("go", "test", "-race", "-count=1", "-timeout=10m", "./...")
+}
+
+// RunWithCoverage runs unit tests and measures coverage (useful for CI)
+func (g Test) RunWithCoverage() error {
+	return sh.RunV("go", "test", "-race", "-count=1", "-timeout=10m", "-covermode=atomic", "-coverprofile=coverage.txt", "./...")
+}